cloudflare 6.2.0 → 6.3.0

package/src/resources/zero-trust/access/ai-controls/mcp/portals.ts

@@ -197,6 +197,17 @@ export namespace PortalCreateResponse {
 
     error?: string;
 
+    error_details?: Server.ErrorDetails;
+
+    /**
+     * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+     * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+     * customer portal hostname. New servers default to true; existing servers default
+     * to false. Effective behavior is gated by the gateway worker's per-env rollout
+     * mode KV key.
+     */
+    is_shared_oauth_callback_enabled?: boolean;
+
     last_successful_sync?: string;
 
     last_synced?: string;
@@ -215,28 +226,75 @@ export namespace PortalCreateResponse {
   }
 
   export namespace Server {
+    export interface ErrorDetails {
+      /**
+       * Underlying error message
+       */
+      cause?: string;
+
+      /**
+       * True = MCP server returned an error. False = couldn't reach the server
+       */
+      is_upstream?: boolean;
+
+      /**
+       * MCP protocol error code
+       */
+      mcp_code?: number;
+
+      /**
+       * Whether the error is transient and worth retrying
+       */
+      retryable?: boolean;
+
+      /**
+       * HTTP status code from the server
+       */
+      status_code?: number;
+    }
+
     export interface UpdatedPrompt {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
 
     export interface UpdatedTool {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
   }
 }
@@ -301,6 +359,17 @@ export namespace PortalUpdateResponse {
 
     error?: string;
 
+    error_details?: Server.ErrorDetails;
+
+    /**
+     * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+     * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+     * customer portal hostname. New servers default to true; existing servers default
+     * to false. Effective behavior is gated by the gateway worker's per-env rollout
+     * mode KV key.
+     */
+    is_shared_oauth_callback_enabled?: boolean;
+
     last_successful_sync?: string;
 
     last_synced?: string;
@@ -319,28 +388,75 @@ export namespace PortalUpdateResponse {
   }
 
   export namespace Server {
+    export interface ErrorDetails {
+      /**
+       * Underlying error message
+       */
+      cause?: string;
+
+      /**
+       * True = MCP server returned an error. False = couldn't reach the server
+       */
+      is_upstream?: boolean;
+
+      /**
+       * MCP protocol error code
+       */
+      mcp_code?: number;
+
+      /**
+       * Whether the error is transient and worth retrying
+       */
+      retryable?: boolean;
+
+      /**
+       * HTTP status code from the server
+       */
+      status_code?: number;
+    }
+
     export interface UpdatedPrompt {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
 
     export interface UpdatedTool {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
   }
 }
@@ -405,6 +521,17 @@ export namespace PortalListResponse {
 
     error?: string;
 
+    error_details?: Server.ErrorDetails;
+
+    /**
+     * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+     * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+     * customer portal hostname. New servers default to true; existing servers default
+     * to false. Effective behavior is gated by the gateway worker's per-env rollout
+     * mode KV key.
+     */
+    is_shared_oauth_callback_enabled?: boolean;
+
     last_successful_sync?: string;
 
     last_synced?: string;
@@ -423,28 +550,75 @@ export namespace PortalListResponse {
   }
 
   export namespace Server {
+    export interface ErrorDetails {
+      /**
+       * Underlying error message
+       */
+      cause?: string;
+
+      /**
+       * True = MCP server returned an error. False = couldn't reach the server
+       */
+      is_upstream?: boolean;
+
+      /**
+       * MCP protocol error code
+       */
+      mcp_code?: number;
+
+      /**
+       * Whether the error is transient and worth retrying
+       */
+      retryable?: boolean;
+
+      /**
+       * HTTP status code from the server
+       */
+      status_code?: number;
+    }
+
     export interface UpdatedPrompt {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
 
     export interface UpdatedTool {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
   }
 }
@@ -540,6 +714,17 @@ export namespace PortalReadResponse {
 
     error?: string;
 
+    error_details?: Server.ErrorDetails;
+
+    /**
+     * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+     * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+     * customer portal hostname. New servers default to true; existing servers default
+     * to false. Effective behavior is gated by the gateway worker's per-env rollout
+     * mode KV key.
+     */
+    is_shared_oauth_callback_enabled?: boolean;
+
     last_successful_sync?: string;
 
     last_synced?: string;
@@ -558,28 +743,75 @@ export namespace PortalReadResponse {
   }
 
   export namespace Server {
+    export interface ErrorDetails {
+      /**
+       * Underlying error message
+       */
+      cause?: string;
+
+      /**
+       * True = MCP server returned an error. False = couldn't reach the server
+       */
+      is_upstream?: boolean;
+
+      /**
+       * MCP protocol error code
+       */
+      mcp_code?: number;
+
+      /**
+       * Whether the error is transient and worth retrying
+       */
+      retryable?: boolean;
+
+      /**
+       * HTTP status code from the server
+       */
+      status_code?: number;
+    }
+
     export interface UpdatedPrompt {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
 
     export interface UpdatedTool {
       name: string;
 
+      /**
+       * @deprecated Deprecated: use `portal_description` or `server_description`
+       * instead. Populated for backward compatibility — portal-level wins when present,
+       * otherwise falls back to server-level. Will be removed after the deprecation
+       * window.
+       */
       description?: string;
 
       enabled?: boolean;
 
       portal_alias?: string;
 
+      portal_description?: string;
+
       server_alias?: string;
+
+      server_description?: string;
     }
   }
 }
@@ -635,6 +867,8 @@ export namespace PortalCreateParams {
 
     default_disabled?: boolean;
 
+    is_shared_oauth_callback_enabled?: boolean;
+
     on_behalf?: boolean;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -711,6 +945,8 @@ export namespace PortalUpdateParams {
 
     default_disabled?: boolean;
 
+    is_shared_oauth_callback_enabled?: boolean;
+
     on_behalf?: boolean;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;

package/src/resources/zero-trust/access/ai-controls/mcp/servers.ts

@@ -136,7 +136,8 @@ export class Servers extends APIResource {
   }
 
   /**
-   * Syncs an MCP server's tool catalog with the portal.
+   * Syncs an MCP server's capabilities and returns the updated server state,
+   * including any connection errors.
    *
    * @example
    * ```ts
@@ -188,6 +189,17 @@ export interface ServerCreateResponse {
 
   error?: string;
 
+  error_details?: ServerCreateResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New servers default to true; existing servers default
+   * to false. Effective behavior is gated by the gateway worker's per-env rollout
+   * mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -204,6 +216,33 @@ export interface ServerCreateResponse {
 }
 
 export namespace ServerCreateResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -249,6 +288,17 @@ export interface ServerUpdateResponse {
 
   error?: string;
 
+  error_details?: ServerUpdateResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New servers default to true; existing servers default
+   * to false. Effective behavior is gated by the gateway worker's per-env rollout
+   * mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -265,6 +315,33 @@ export interface ServerUpdateResponse {
 }
 
 export namespace ServerUpdateResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -310,6 +387,17 @@ export interface ServerListResponse {
 
   error?: string;
 
+  error_details?: ServerListResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New servers default to true; existing servers default
+   * to false. Effective behavior is gated by the gateway worker's per-env rollout
+   * mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -326,6 +414,33 @@ export interface ServerListResponse {
 }
 
 export namespace ServerListResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -371,6 +486,17 @@ export interface ServerDeleteResponse {
 
   error?: string;
 
+  error_details?: ServerDeleteResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New servers default to true; existing servers default
+   * to false. Effective behavior is gated by the gateway worker's per-env rollout
+   * mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -387,6 +513,33 @@ export interface ServerDeleteResponse {
 }
 
 export namespace ServerDeleteResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -432,6 +585,17 @@ export interface ServerReadResponse {
 
   error?: string;
 
+  error_details?: ServerReadResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New servers default to true; existing servers default
+   * to false. Effective behavior is gated by the gateway worker's per-env rollout
+   * mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -448,6 +612,33 @@ export interface ServerReadResponse {
 }
 
 export namespace ServerReadResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -469,7 +660,42 @@ export namespace ServerReadResponse {
   }
 }
 
-export type ServerSyncResponse = unknown;
+export interface ServerSyncResponse {
+  error?: string;
+
+  error_details?: ServerSyncResponse.ErrorDetails;
+
+  status?: string;
+}
+
+export namespace ServerSyncResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+}
 
 export interface ServerCreateParams {
   /**
@@ -507,6 +733,15 @@ export interface ServerCreateParams {
    */
   description?: string | null;
 
+  /**
+   * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
+   * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
+   * the customer portal hostname. New servers default to true; existing servers
+   * default to false. Effective behavior is gated by the gateway worker's per-env
+   * rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   /**
    * Body param
    */
@@ -556,6 +791,15 @@ export interface ServerUpdateParams {
    */
   description?: string | null;
 
+  /**
+   * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
+   * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
+   * the customer portal hostname. New servers default to true; existing servers
+   * default to false. Effective behavior is gated by the gateway worker's per-env
+   * rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   /**
    * Body param
    */